JP2005124055A - Defense device of network attack - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To discard an attack packet without deteriorating service quality to a legitimate user. <P>SOLUTION: When the packet of an IP address which is not recorded in a normal communication management table comes in, the packet is temporarily held in a self-device, the IP address is recorded in an attack possibility decision table and a reception confirmation packet is returned to the IP address. When the reception confirmation packet from a returning destination comes within a fixed time from return of the reception confirmation packet, the IP address is recorded in the normal communication management table, the IP address already recorded in the attack possibility decision table is deleted and the packet held in the self-device is transferred to a server. When a packet in which the IP address is recorded in the attack possibility decision table comes in, the packet is discarded. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention is used in a communication system in which a client and a server are connected via a network. In particular, the present invention relates to a defense technique against an attack performed by a malicious client trying to paralyze the server function.

  A normal TCP (Transmission Control Protocol) communication procedure will be described with reference to FIG. A server 2 and a client 3 are connected via a network 4. At this time, if a SYN packet is transmitted from the client 3 to the server 2, a SYN-ACK packet is returned from the server 2 to the client 3. As a result, the client 3 and the server 2 become communicable.

  Next, an attack called a SYN attack that disables the service of the server will be described with reference to FIG. As shown in FIG. 15, the characteristic of the attack is that the malicious client 3 continues to send the SYN packet to the server 2 to prevent correct communication to be performed normally. Furthermore, an attacker may spoof his / her IP address. At this time, the server 2 sends the SYN-ACK packet to the spoofed client, not the malicious client 3 that sent the SYN packet. Since the misrepresented client repeatedly returns the SYN-ACK packet for the SYN packet that is not sent by itself, the client is in an abnormal situation where the SYN packet requested by the client cannot be sent.

A conventional defense device against such an attack will be described with reference to FIG. The conventional defense device 11 against a SYN attack does not distinguish between an attack SYN packet and a normal SYN packet, measures the transmission rate of the SYN packet, and discards all SYN packets having a transmission rate equal to or higher than a set threshold. (For example, refer nonpatent literature 1).
“DDoS attack defense measures”, [online], June 3, 2003, National Police Agency Technology Countermeasures Cyber Terrorism Countermeasures Office, [October 7, 2003 Search], Internet, <URL: http: //www.cyberpolice.go.jp/server/virus/pdf/Strategies_to_Protect_Against_DDoS_Attacks.pdf>

  In such a conventional defense device, the server can be protected, but even the SYN packet of the client that performs correct communication is discarded, which causes the service quality of the legitimate client to deteriorate.

  The present invention has been made in such a background, and an object of the present invention is to provide a defense device capable of discarding an attack packet without degrading the quality of service for a legitimate client.

  The present invention is capable of distinguishing an attack that does not establish a session from a correct communication and an attack that is about to attack, and is characterized by discarding only attack packets. In addition, since the reception confirmation packet is returned to the IP address of the packet arriving from the client, when the malicious client spoofs the IP address, the reception confirmation packet is sent to the client that has not actually transmitted the packet. Will be returned. Therefore, the subsequent communication procedure is not established, and the spoofing of the IP address can be found.

  That is, the first aspect of the present invention is a network attack that is provided between a client and a server that are connected to each other via a network and includes means for monitoring packets sent from the client to the server. It is a defense device.

  Here, the present invention is characterized in that the monitoring means includes a normal communication management table that records the IP address of a client that has performed normal communication, and a packet with an IP address that is not recorded in the normal communication management table. An attack possibility determination table for recording the IP address when it arrives, a means for passing the packet as it is toward the server when a packet of the IP address recorded in the normal communication management table arrives, and the normal When a packet with an IP address that is not recorded in the communication management table arrives, the packet is temporarily held in its own device, the IP address is recorded in the attack possibility determination table, and a reception confirmation packet is sent to the IP address. Return means and return acknowledgment packet by this return means When an acknowledgment packet from the return destination arrives within a certain period of time, the IP address is recorded in the normal communication management table and the IP address already recorded in the attack possibility determination table is deleted. And means for transferring the packet held in its own device to the server, and means for discarding the packet when an IP address is recorded in the attack possibility determination table. (Claim 1).

  Thereby, a suspicious packet and a legitimate packet can be distinguished. In addition, suspicious packets can be discarded immediately.

A means for deleting a record that has not been updated for t1 time in the normal communication management table; and a means for deleting a record that has not been updated for t2 time in the attack possibility determination table.
t1 ≦ t2
(Claim 2).

  The reason why the record of the normal communication management table is periodically deleted is that the client of the IP address that has performed normal communication is not always normal. In addition, a malicious client may misrepresent the IP address of another client, and a malicious client may attack using an IP address that has been normally communicated in the past. Assuming such a case, it is desirable to periodically delete the record of the normal communication management table.

  Further, by periodically deleting the records of the attack possibility determination table and refreshing the recorded contents, the storage area of each table can be used effectively. At this time, it is preferable to set the update cycle of the normal communication management table shorter than the update cycle of the attack possibility determination table. The reason for this is that, as described above, the client with the IP address that has been performing normal communication in the past may be transformed into a client that attacks, so it is safe to update the normal communication management table frequently. It is. On the other hand, since it is generally considered unlikely that a client who has attacked in the past recorded in the attack possibility determination table will be transformed into a normal client, The update frequency may be smaller than that of the normal communication management table.

  Alternatively, the monitoring unit of the present invention includes a normal communication management table that records an IP address of a client that has performed normal communication, an abnormal communication management table that records an IP address of a client that has performed abnormal communication, and the normal communication. When a packet with an IP address not recorded in the management table arrives, an attack possibility determination table that records the IP address, and when a packet with an IP address recorded in the normal communication management table arrives, the packet is sent as it is. When a packet with an IP address recorded in the abnormal communication management table arrives, there is no record in the normal communication management table and the abnormal communication management table. When an IP address packet arrives The packet is temporarily held in its own apparatus, its IP address is recorded in the attack possibility determination table, a reception confirmation packet is returned to the IP address, and a reception confirmation packet is returned by the return means. When a reception confirmation packet from the return destination arrives within a certain period of time, the IP address is recorded in the normal communication management table and the IP address already recorded in the attack possibility determination table is deleted. When the reception confirmation packet from the return destination does not arrive within a predetermined time from the return of the reception confirmation packet by the means for transferring the packet held in its own device to the server and the return means, the IP address The packet whose address is recorded in the abnormal communication management table and held in its own device Characterized by comprising a means for discarding (claim 3).

  Thus, by providing the abnormal communication management table, it is possible to promptly discard packets from clients with IP addresses that have performed abnormal communication in the past.

A means for deleting the IP address recorded in the abnormal communication management table from the attack possibility determination table; a means for deleting a record that has not been updated for t1 time in the normal communication management table; and the abnormal communication management. Means for deleting records that have not been updated for t3 time in the table,
t1 ≦ t3
(Claim 4).

  That is, duplication of records in the abnormal communication management table and the attack possibility determination table is meaningless. Such duplication can be avoided and the attack possibility determination table can be used effectively.

  Further, it is preferable to set the update cycle of the normal communication management table shorter than the update cycle of the abnormal communication management table. The reason for this is that, as described above, the client with the IP address that has been performing normal communication in the past may be transformed into a client that attacks, so it is safe to update the normal communication management table frequently. It is. On the other hand, it is generally considered unlikely that a client who has attacked in the past recorded in the abnormal communication management table will be transformed into a normal client. The update frequency may be smaller than that of the management table.

  The attack possibility determination table may be included in either the normal communication management table or the abnormal communication management table.

  For example, if the recorded content of the attack possibility determination table is deleted when it is recorded in the abnormal communication management table, the attack possibility determination table need only be temporarily recorded. That is, the storage capacity may be small compared to other tables. Therefore, the attack possibility determination table can be realized by allocating a partial storage area of any other table. Thereby, the memory configuration can be simplified.

  According to a second aspect of the present invention, when installed in an information processing apparatus, the information processing apparatus is provided between a client and a server connected to each other via a network, and is transmitted from the client to the server. It is a program that realizes a function corresponding to a network attack defense device having a function of monitoring received packets.

  Here, the feature of the present invention is that the monitoring function includes a function corresponding to a normal communication management table that records the IP address of a client that has performed normal communication, and an IP that is not recorded in the normal communication management table. A function corresponding to an attack possibility determination table that records an IP address when a packet of an address arrives, and when a packet of an IP address recorded in the normal communication management table arrives, the packet is directly directed to the server. When a packet with an IP address that is not recorded in the normal communication management table arrives, the packet is temporarily held in the own device, and the IP address is recorded in the attack possibility determination table. A function for returning a reception confirmation packet to an IP address, and a function for returning the packet. When a reception confirmation packet arrives from the return destination within a certain period of time after the return of the reception confirmation packet, the IP address is recorded in the normal communication management table and already recorded in the attack possibility determination table. A function of deleting the IP address in question and transferring the packet held in the own device to the server, and a function of discarding the packet when an IP address is recorded in the attack possibility determination table (Claim 6).

A function of deleting a record that has not been updated for t1 time in the normal communication management table and a function of deleting a record that has not been updated for t2 time in the attack possibility determination table;
t1 ≦ t2
(Claim 7).

  Alternatively, the program according to the present invention includes a function corresponding to a normal communication management table that records the IP address of a client that has performed normal communication and an abnormal communication that records the IP address of a client that has performed abnormal communication as the monitoring function. A function corresponding to a management table, a function corresponding to an attack possibility determination table for recording an IP address packet not recorded in the normal communication management table, and a function corresponding to an attack possibility determination table for recording the IP address are recorded in the normal communication management table. A function of passing the packet as it is toward the server when the packet of the IP address arrives, a function of discarding the packet when a packet of the IP address recorded in the abnormal communication management table arrives, The normal communication management table and the abnormal communication pipe When a packet with an IP address not recorded in the table arrives, the packet is temporarily held in its own device, the IP address is recorded in the attack possibility determination table, and a reception confirmation packet is returned to the IP address. Function, and when a reception confirmation packet from the return destination arrives within a predetermined time after the return of the reception confirmation packet by the return function, the IP address is recorded in the normal communication management table and the possibility of attack is determined. The function deletes the IP address already recorded in the table, transfers the packet held in its own device to the server, and returns it within a certain period of time after returning the reception confirmation packet by the returning function. When the reception confirmation packet from the destination does not arrive, the IP address is passed through the abnormal communication. Is a program for causing and a function of discarding the packets held in its own apparatus and records the management table (claim 8).

A function for deleting the IP address recorded in the abnormal communication management table from the attack possibility determination table; a function for deleting a record that has not been updated for t1 time in the normal communication management table; and the abnormal communication management. Realizing the function of deleting records that have not been updated for t3 time in the table,
t1 ≦ t3
(Claim 9).

  Further, the attack possibility determination table can be included in either the normal communication management table or the abnormal communication management table.

  A third aspect of the present invention is a recording medium readable by the information processing apparatus on which the program of the present invention is recorded (claim 11). By recording the program of the present invention on the recording medium of the present invention, the information processing apparatus can install the program of the present invention using this recording medium. Alternatively, the program of the present invention can be directly installed on the information processing apparatus via a network from a server holding the program of the present invention.

  Accordingly, it is possible to realize a network attack defense device capable of discarding attack packets without degrading service quality for a legitimate client using a general-purpose information processing device.

  According to the present invention, attack packets can be discarded without degrading service quality for a legitimate client.

(First Example)
A first embodiment will be described with reference to FIGS. FIG. 1 is a diagram showing processing when the IP address of a SYN packet that has arrived at the defense device is recorded in the normal communication management table. FIG. 2 is a diagram showing processing when the IP address of the SYN packet that has arrived at the defense device is not recorded in the normal communication management table. FIG. 3 is a diagram showing processing in a case where the client of the IP address of the SYN packet that has arrived at the defense device is a client that attacks. FIG. 4 is a diagram illustrating a process when the IP address of the SYN packet that has arrived at the defense device is recorded in the attack possibility determination table. FIG. 5 is a diagram showing an arrangement relationship between the normal communication management table and the attack possibility determination table.

  The first embodiment is a network attack that is provided between a client 3 and a server 2 connected to each other via a network 4 and includes means for monitoring a SYN packet sent from the client 3 to the server 2 This is a defense device 1 of FIG.

  Here, the first embodiment is characterized in that the monitoring means includes a normal communication management table 10 that records the IP address of a client that has performed normal communication, and an IP that is not recorded in the normal communication management table 10. When an address packet arrives, the attack possibility determination table 20 for recording the IP address and the IP address packet recorded in the normal communication management table 10 pass the packet as it is toward the server 2. When a packet with an IP address not recorded in the normal communication management table 10 arrives, the packet is temporarily held in the own device, and the IP address is recorded in the attack possibility determination table 20 and addressed to the IP address. Means for returning a SYN-ACK packet to the receiver, and SY by this means for returning -When an ACK packet from the return destination arrives within a certain period of time after the return of the ACK packet, the IP address is recorded in the normal communication management table 10 and is already recorded in the attack possibility determination table 20 Means for deleting the IP address and transferring the packet held in its own device to the server 2, and means for discarding the packet when the packet whose IP address is recorded in the attack possibility determination table 20 arrives (Claim 1).

And a means for deleting a record that has not been updated for t1 time in the normal communication management table 10, and a means for deleting a record that has not been updated for t2 time in the attack possibility determination table 20.
t1 ≦ t2
(Claim 2).

  Hereinafter, the first embodiment will be described in detail.

  As shown in FIG. 1, the defense device 1 of this embodiment is inserted between a server 2 and a client 3 connected via a network 4. In the first embodiment, when a SYN packet arrives from the client 3 to the server 2, it is determined whether or not the defense device 1 is from an IP address that has performed correct communication in the past. For this purpose, the normal communication management table 10 is provided, and the IP address of the incoming SYN packet is compared with the past IP address recorded in the normal communication management table 10.

  As shown in FIG. 1, when the defense device 1 receives a SYN packet sent from the client 3 to the server 2, it searches the normal communication management table 10 and comes from an IP address that has performed correct communication in the past. If it is a SYN packet, the SYN packet is transferred to the server 2 as it is. A SYN-ACK packet corresponding to the SYN packet is returned from the server 2.

  As shown in FIG. 2, if the SYN packet arriving at the defense device 1 is a SYN packet that does not have an IP address in the normal communication management table 10, the source IP address is registered in the attack possibility determination table 20, and the source IP address The SYN-ACK packet is returned from the defense device 1 to the network.

  Here, if an ACK packet is received from the client 3 within a certain time, it is known that the client 3 of the IP address is a normal client, so the source IP address is deleted from the attack possibility determination table 20 At the same time, the source IP address is registered in the normal communication management table 10 and the SYN packet is transmitted to the server 2. The server 2 returns a SYN-ACK packet for the SYN packet to the client 3 again.

  As shown in FIG. 3, when a SYN-ACK packet is returned from the defense device 1 to a SYN packet that does not have an IP address in the normal communication management table 10, when the ACK packet does not come within a certain time, It can be determined that there is a possibility of attack, and the SYN packet is discarded without being transmitted to the server 2. Further, the IP address is recorded as it is in the attack possibility determination table 20.

  Here, as a basis for determining that there is a possibility of an attack when the ACK packet is not returned within a certain time, for example, if the IP address that returned the SYN-ACK packet is spoofed, the SYN-ACK packet is The destination client does not have a history of sending SYN packets. Therefore, an ACK packet for the SYN-ACK packet is not returned. Thereby, it can be determined that the transmission source of the SYN packet is a malicious client that spoofed the IP address. Alternatively, if the client is making a SYN attack, the ACK packet is not returned from the beginning, and the SYN packet is continuously transmitted. Thereby, it can be determined that the transmission source of the SYN packet is a malicious client.

  As shown in FIG. 4, when a SYN packet having an IP address in the attack possibility determination table 20 arrives at the defense device 1, it is immediately discarded.

  As shown in FIG. 5, the normal communication management table 10 and the attack possibility determination table 20 are arranged. In addition, the normal communication management table 10 and the attack possibility determination table 20 are maintained based on a certain period or some trigger. In the maintenance, if the record of the table has not been updated for a certain period of time, the record is deleted. As a result, an increase in the number of records in the table can be avoided, and even if a malicious client has misrepresented the IP address of a client that has made a correct communication in the past, the normal communication management table if it has not been updated for a certain period of time. Since the IP address is deleted from 10, it is possible to avoid passing through the defense device 1.

(Second embodiment)
A second embodiment will be described with reference to FIGS. FIG. 6 is a diagram showing processing when the IP address of the SYN packet that has arrived at the defense device matches the IP address recorded in the abnormal communication management table. FIG. 7 is a diagram showing processing when the IP address of the SYN packet that has arrived at the defense device matches the IP address recorded in the normal communication management table. FIG. 8 shows a process when an ACK is returned from a client within a predetermined time when the IP address of the SYN packet that has arrived at the defense device does not match the IP address recorded in both the abnormal communication management table and the normal communication management table. FIG. FIG. 9 shows the processing when the ACK is not returned from the client within a predetermined time when the IP address of the SYN packet that has arrived at the defense device does not match the IP address recorded in both the abnormal communication management table and the normal communication management table. FIG. 10 to 12 are diagrams showing the arrangement of a normal communication management table, an abnormal communication management table, and an attack possibility determination table in the second embodiment.

  The second embodiment is a network attack that is provided between a client 3 and a server 2 connected to each other via a network 4 and includes means for monitoring a SYN packet sent from the client 3 to the server 2 This is a defense device 1 of FIG.

  Here, the feature of the second embodiment is that the monitoring means records the normal communication management table 10 that records the IP address of the client that performed normal communication, and the IP address of the client that performed abnormal communication. Abnormal communication management table 30, an attack possibility determination table 20 for recording an IP address packet not recorded in the normal communication management table 10, and an IP address recorded in the normal communication management table 10. Means for passing the packet as it is toward the server 2, means for discarding the packet when an IP address recorded in the abnormal communication management table 30 arrives, and normal communication management IP addresses not recorded in table 10 and abnormal communication management table 30 When a reply packet arrives, the packet is temporarily held in its own device, its IP address is recorded in the attack possibility determination table 20, and a SYN-ACK packet is sent back to the IP address. When an ACK packet from the return destination arrives within a certain period of time after the return of the SYN-ACK packet by the means for performing the above, the IP address is recorded in the normal communication management table 10 and already recorded in the attack possibility determination table 20 The IP address is deleted, and the packet sent from the return destination is transferred within a predetermined time from the return of the SYN-ACK packet by the means for transferring the packet held in its own device to the server 2 and the return means. When the ACK packet does not arrive, the IP address is assigned to the abnormal communication management table 3 It is in place and means for discarding the packets held in its own device and records the (claim 3).

Further, the IP address recorded in the abnormal communication management table 30 is deleted from the attack possibility determination table 20, the means for deleting the record that has not been updated in the normal communication management table 10 for t1, and the abnormal communication management table. Means for deleting records that have not been updated for 30 t3 hours,
t1 ≦ t3
(Claim 4).

  Further, as shown in FIG. 10, the attack possibility determination table 20 is set between the normal communication management table 10 and the abnormal communication management table 20, but the attack possibility determination table 20 is compared with the first embodiment. Since only temporary recording needs to be performed, the storage capacity is small. Therefore, as another embodiment, a part of the storage area of the normal communication management table 10 is allocated to the attack possibility determination table 20 as shown in FIG. 11, or the abnormal communication management table is shown in FIG. A part of the 30 storage areas may be allocated to the attack possibility determination table 20 (claim 5).

  Hereinafter, the second embodiment will be described in detail.

  The defense device 1 of the second embodiment is characterized by having an abnormal communication management table 30 in addition to the configuration of the defense device 1 of the first embodiment.

  As shown in FIG. 6, when the defense device 1 accepts a SYN packet sent from the client 3 to the server 2 and there is an IP address in the abnormal communication management table 30, it is immediately determined that the attack has occurred, and the packet Discard.

  As shown in FIG. 7, if there is no IP address in the abnormal communication management table 30 and there is an IP address in the normal communication management table 10, the SYN packet is transmitted to the server 2 as it is. Thus, normal communication can be performed as it is.

  As shown in FIG. 8, if there is no IP address in the abnormal communication management table 30, but there is no IP address in the normal communication management table 10, the source IP address is registered in the attack possibility determination table 20, and the source A SYN-ACK packet is returned from the defense device 1 to the IP address.

  Here, if an ACK packet is received from the client 3 within a certain time, the client 3 is regarded as a normal client, and the source IP address is deleted from the attack possibility determination table 20 and is transmitted to the normal communication management table 10. The original IP address is registered and a SYN packet is transmitted to the server 2. The server 2 returns a SYN-ACK packet for the SYN packet again.

  As shown in FIG. 9, if there is no IP address in the abnormal communication management table 30, but there is no IP address in the normal communication management table 10, the source IP address is registered in the attack possibility determination table 20, and the source A SYN-ACK packet is returned from the defense device 1 to the IP address.

  Here, when the ACK packet from the client 3 does not come within a certain time with respect to the SYN-ACK packet from the defense device 1, it can be determined as an attack as described in the first embodiment, and the IP address Is registered in the abnormal communication management table 30. The IP address registered in the abnormal communication management table 30 is deleted from the attack possibility determination table 20.

  As in the first embodiment, the normal communication management table 10 and the abnormal communication management table 30 are maintained based on a certain period or some trigger. In the maintenance, if the record of the table has not been updated for a certain period of time, the record is deleted. As a result, an increase in the number of records in the table can be avoided, and even if a malicious client has misrepresented the IP address of a client that has made a correct communication in the past, the normal communication management table if it has not been updated for a certain period of time. Since the IP address is deleted from 10, it is possible to avoid passing through the defense device 1.

(Third embodiment)
A third embodiment will be described with reference to FIG. The operation of the third embodiment is the same as that of the first and second embodiments. In the third embodiment, unlike the first and second embodiments, the installation position of the defense device is installed between the network 4 and the client 3. As a result, the SYN packet sent from the malicious client 3 can be discarded at the entrance of the network 4, so that invalid packets are not transferred through the network 4, and network resources are used effectively. Can do. On the other hand, since the number of clients 3 is generally larger than the number of servers 2, the number of defense devices 1 installed is larger than that of the first and second embodiments.

(Fourth embodiment)
The present invention can be implemented as a program that, when installed in a general-purpose information processing device, causes the information processing device to realize a function corresponding to the defense device of the present invention (claims 6 to 10). The program is recorded in a recording medium and installed in the information processing apparatus (claim 11), or installed in the information processing apparatus via a communication line, so that the information processing apparatus is provided with the first to third embodiments. The function corresponding to each means and each table in the protective device 1 can be realized.

  According to the present invention, attack packets can be discarded without degrading the service quality for a legitimate client, so that the service quality for the client can be improved.

The figure which shows a process in case the IP address of the SYN packet which arrived at the defense apparatus is recorded on the normal communication management table. The figure which shows a process in case the IP address of the SYN packet which arrived at the defense apparatus is not recorded on the normal communication management table. The figure which shows a process in case the client of the IP address of the SYN packet which arrived at the defense apparatus is a client which attacks. The figure which shows a process in case the IP address of the SYN packet which arrived at the defense apparatus is recorded on the attack possibility judgment table. The figure which shows the arrangement | positioning relationship between a normal communication management table and an attack possibility judgment table. The figure which shows a process when the IP address of the SYN packet which arrived at the defense apparatus corresponds with the IP address recorded on the abnormal communication management table. The figure which shows a process when the IP address of the SYN packet which arrived at the defense apparatus corresponds with the IP address recorded on the normal communication management table. The figure which shows a process when ACK is returned from a client within a fixed time, when the IP address of the SYN packet which arrived at the defense apparatus does not correspond with the IP address recorded on both the abnormal communication management table and the normal communication management table. . The figure which shows a process when ACK is not returned from a client within a fixed time, when the IP address of the SYN packet which arrived at the defense apparatus does not correspond with the IP address recorded on both the abnormal communication management table and the normal communication management table. The figure which shows arrangement | positioning of the normal communication management table in 2nd Example, an abnormal communication management table, and an attack possibility judgment table. The figure which shows arrangement | positioning of the normal communication management table in 2nd Example, an abnormal communication management table, and an attack possibility judgment table. The figure which shows arrangement | positioning of the normal communication management table in 2nd Example, an abnormal communication management table, and an attack possibility judgment table. The figure which shows the defense apparatus arrangement position of a 3rd Example. The figure for demonstrating the communication procedure of normal TCP. The figure for demonstrating the attack called the SYN attack which makes the service of the server impossible. The figure for demonstrating the conventional defense apparatus with respect to a SYN attack.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1, 11 Defense apparatus 2 Server 3 Client 4 Network 10 Normal communication management table 20 Attack possibility judgment table 30 Abnormal communication management table

Claims (11)

In a network attack defense apparatus provided between a client and a server connected to each other via a network and provided with a means for monitoring packets sent from the client to the server,
The means for monitoring is
A normal communication management table that records the IP address of the client that performed normal communication;
An attack possibility determination table that records the IP address when a packet of an IP address that is not recorded in the normal communication management table arrives;
When a packet of an IP address recorded in the normal communication management table arrives, means for passing the packet as it is toward the server;
When a packet with an IP address not recorded in the normal communication management table arrives, the packet is temporarily held in its own device, the IP address is recorded in the attack possibility determination table, and reception is confirmed for the IP address. A means of returning packets;
When a reception confirmation packet arrives from the return destination within a predetermined time from the return of the reception confirmation packet by the returning means, the IP address is recorded in the normal communication management table and also in the attack possibility determination table. Means for deleting the IP address already recorded and transferring the packet held in its own device to the server;
And a means for discarding the packet when an IP address recorded in the attack possibility determination table arrives. Means for deleting a record that has not been updated for t1 time in the normal communication management table;
Means for deleting a record that has not been updated for t2 time in the attack possibility determination table;
t1 ≦ t2
The defense device according to claim 1. In a network attack defense apparatus provided between a client and a server connected to each other via a network and provided with a means for monitoring packets sent from the client to the server,
The means for monitoring is
A normal communication management table that records the IP address of the client that performed normal communication;
An abnormal communication management table that records the IP address of the client that performed the abnormal communication;
An attack possibility determination table that records an IP address when a packet of an IP address that is not recorded in the normal communication management table arrives;
When a packet of an IP address recorded in the normal communication management table arrives, means for passing the packet as it is toward the server;
Means for discarding the packet of the IP address recorded in the abnormal communication management table;
When a packet of an IP address that is not recorded in the normal communication management table and the abnormal communication management table arrives, temporarily hold the packet in its own device, record the IP address in the attack possibility determination table, Means for returning an acknowledgment packet to the IP address;
When a reception confirmation packet arrives from the return destination within a predetermined time from the return of the reception confirmation packet by the return means, the IP address is recorded in the normal communication management table and already in the attack possibility determination table. Means for deleting the recorded IP address and transferring the packet held in its own device to the server;
When the reception confirmation packet from the return destination does not arrive within a predetermined time from the return of the reception confirmation packet by the returning means, the IP address is recorded in the abnormal communication management table and held in the own apparatus. And a means for discarding the packet. Means for deleting the IP address recorded in the abnormal communication management table from the attack possibility determination table;
Means for deleting a record that has not been updated for t1 time in the normal communication management table;
Means for deleting a record that has not been updated for t3 time in the abnormal communication management table;
t1 ≦ t3
The defense device according to claim 3.   The defense apparatus according to claim 3, wherein the attack possibility determination table is included in either the normal communication management table or the abnormal communication management table. By installing on an information processing device,
In a program that is provided between a client and a server that are connected to each other via a network, and that realizes a function corresponding to a network attack protection device having a function of monitoring a packet sent from the client to the server ,
As the monitoring function,
A function corresponding to the normal communication management table that records the IP address of the client that has performed normal communication;
A function corresponding to an attack possibility determination table for recording an IP address packet that is not recorded in the normal communication management table;
When the packet of the IP address recorded in the normal communication management table arrives, the function of passing the packet as it is toward the server;
When a packet with an IP address not recorded in the normal communication management table arrives, the packet is temporarily held in its own device, the IP address is recorded in the attack possibility determination table, and reception is confirmed for the IP address. The ability to send packets back,
When a reception confirmation packet arrives from the return destination within a predetermined time from the return of the reception confirmation packet by the returning function, the IP address is recorded in the normal communication management table and also in the attack possibility determination table. A function of deleting the IP address already recorded and transferring the packet held in its own device to the server;
A program for realizing a function of discarding a packet having an IP address recorded in the attack possibility determination table when the packet arrives. A function of deleting records that have not been updated for t1 time in the normal communication management table;
A function of deleting a record that has not been updated for t2 time in the attack possibility determination table;
t1 ≦ t2
The program according to claim 6. By installing on an information processing device,
In a program that is provided between a client and a server that are connected to each other via a network, and that realizes a function corresponding to a network attack protection device having a function of monitoring a packet sent from the client to the server ,
As the monitoring function,
A function corresponding to the normal communication management table that records the IP address of the client that has performed normal communication;
A function corresponding to the abnormal communication management table that records the IP address of the client that performed the abnormal communication;
A function corresponding to an attack possibility determination table for recording an IP address packet that is not recorded in the normal communication management table;
When the packet of the IP address recorded in the normal communication management table arrives, the function of passing the packet as it is toward the server;
A function of discarding a packet of an IP address recorded in the abnormal communication management table;
When a packet of an IP address that is not recorded in the normal communication management table and the abnormal communication management table arrives, temporarily hold the packet in its own device, record the IP address in the attack possibility determination table, A function of returning a reception confirmation packet to the IP address;
When a reception confirmation packet arrives from the return destination within a predetermined time from the return of the reception confirmation packet by the returning function, the IP address is recorded in the normal communication management table and already in the attack possibility determination table. A function of deleting the recorded IP address and transferring the packet held in its own device to the server;
When the reception confirmation packet from the return destination does not arrive within a predetermined time from the return of the reception confirmation packet by the returning function, the IP address is recorded in the abnormal communication management table and held in the own device. A program characterized by realizing a packet discard function. A function of deleting the IP address recorded in the abnormal communication management table from the attack possibility determination table;
A function of deleting records that have not been updated for t1 time in the normal communication management table;
A function of deleting a record that has not been updated for t3 time in the abnormal communication management table; and t1 ≦ t3
The program according to claim 8.   9. The program according to claim 8, wherein the attack possibility determination table is included in either the normal communication management table or the abnormal communication management table.   11. A recording medium readable by the information processing apparatus, on which the program according to claim 6 is recorded.

Images